CVE Vulnerability Catalog

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed. Unauthenticated attackers can arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce plugin to be active.

A path traversal vulnerability was found in the IHM Log handling of ADM. User-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file.

A path traversal vulnerability in the Wallpaper component of ADM. User-controlled wallpaper path input is not sufficiently validated, allowing access to files outside the intended wallpaper directory.

A price manipulation vulnerability in the Persian Elementor plugin for WordPress. The plugin trusts user-supplied payment amounts without server-side validation, allowing unauthenticated attackers to submit arbitrary amounts to the ZarinPal gateway.

A second-order SQL injection vulnerability in the Improved Save Button plugin for WordPress. Via the 'meta_key' custom field and 'Save and Duplicate' action, authenticated attackers with author-level access can append additional SQL queries to existing queries.

A vulnerability in the Valibot library (versions prior to 1.4.2) where the flatten() helper throws a TypeError when validating objects with keys like toString, valueOf, or hasOwnProperty. This can crash the request path instead of returning structured validation errors.

In Google Chrome prior to version 151.0.7922.72, a side-channel information leakage exists in the Media component. A remote attacker can use a crafted HTML page to leak cross-origin data.

In Google Chrome on Windows prior to version 151.0.7922.72, an inappropriate implementation in the Updater component allows a local attacker to perform UI spoofing via a malicious file.

In Google Chrome on iOS prior to version 151.0.7922.72, insufficient policy enforcement in the Chrome for iOS component allows a remote attacker to perform UI spoofing via a crafted HTML page.

In Google Chrome prior to version 151.0.7922.72, insufficient validation of untrusted input in the DevTools component allows a remote attacker to bypass navigation restrictions via a malicious file.

In Google Chrome on iOS prior to version 151.0.7922.72, an inappropriate implementation in the Chrome for iOS component allows a remote attacker to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in Passwords in Google Chrome prior to version 151.0.7922.72 allows a remote attacker to perform UI spoofing via malicious network traffic.

Insufficient validation of untrusted input in Passwords in Google Chrome prior to version 151.0.7922.72 allows a remote attacker to perform UI spoofing via malicious network traffic.

Inappropriate implementation in Settings in Google Chrome prior to version 151.0.7922.72 allows a remote attacker to perform UI spoofing via malicious network traffic.

Inappropriate implementation in Input in Google Chrome on Android prior to version 151.0.7922.72 allows a remote attacker to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in Google Lens in Google Chrome prior to version 151.0.7922.72 allows a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in WebXR in Google Chrome prior to version 151.0.7922.72 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Insufficient policy enforcement in Speech in Google Chrome prior to version 151.0.7922.72 allows a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to version 151.0.7922.72 allows a remote attacker to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.